GitHub's surface is enormous, so the default is five toolsets and everything else is opt-in by name — worth configuring deliberately rather than reaching for all. Two guards sit beside it: --read-only strips the writing tools outright, and lockdown mode filters content from public-repository authors without push access to blunt prompt injection. GitHub is explicit that lockdown is a best-effort content filter and not an authorization boundary, so treat it as one layer rather than the fence.
GitHub's MCP server for the GitHub platform, in two forms over the same API surface: a remote endpoint GitHub hosts at https://api.githubcopilot.com/mcp/, and a local binary or Docker image you run with your own token.
- Repository work: file contents read and written, branches and tags, commits, releases, the repository tree, forks, collaborators and code search — get_file_contents, create_or_update_file, push_files, create_branch, list_branches, list_commits, get_commit, get_repository_tree, list_releases, fork_repository, search_code
- Issues end to end, including sub-issues, labels, fields and types — issue_read, issue_write, sub_issue_write, list_issues, search_issues, add_issue_comment, list_issue_fields, list_issue_types
- Pull requests created, read in detail, reviewed comment by comment, merged, updated and their branches refreshed — create_pull_request, pull_request_read, add_comment_to_pending_review, pull_request_review_write, merge_pull_request, update_pull_request, update_pull_request_branch, search_pull_requests
- Actions: workflows and runs listed and inspected, a run triggered, and the logs of the job that failed — actions_list, actions_get, actions_run_trigger, get_job_logs
- Security findings in one place: code scanning, Dependabot, secret scanning and published advisories — list_code_scanning_alerts, list_dependabot_alerts, list_secret_scanning_alerts, get_secret_scanning_alert, list_global_security_advisories
- Discussions, gists, labels, notifications, projects, stargazers, organizations, users and low-level Git operations, each in its own toolset enabled by name
- Work handed to Copilot: an issue assigned, a review requested, and — on the remote server — a pull request opened by the coding agent, Copilot Spaces read, and GitHub's support docs searched — assign_copilot_to_issue, request_copilot_review, create_pull_request_with_copilot, get_copilot_space, github_support_docs_search
- Two safety switches: read-only mode, which offers only the reading tools, and lockdown mode, which withholds or filters public-repository content authored by people without push access
A GitHub account. The remote server is authorized over OAuth in hosts that support it, or with a personal access token — enterprise-managed users have PATs disabled until an administrator enables them. Locally it takes GITHUB_PERSONAL_ACCESS_TOKEN and runs as the binary or the ghcr.io/github/github-mcp-server image. Only five toolsets are on by default — context, repos, issues, pull_requests and users — and the rest are named in GITHUB_TOOLSETS, the --toolsets flag, a URL path or an HTTP header depending on how you run it, with all as the catch-all. GitHub Enterprise Server cannot use the remote endpoint; Enterprise Cloud with data residency has its own.
One command plus a key — claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer YOUR_GITHUB_PAT"}}', then supply credentials